Give a bubblewrap sandbox a fresh PID namespace with proper /proc and /dev

Documented steps

1. Add --unshare-pid to create a new PID namespace.
2. Mount a namespace-scoped procfs with --proc /proc rather than binding the host's /proc into the sandbox.
3. Mount a fresh devtmpfs with --dev /dev.
4. Note bwrap's reaper: with a PID namespace, bwrap runs a minimal pid-1 process that reaps zombies and reports the initial application process (pid 2) exit status back to the spawner (per the man page).
5. If your command must itself be pid 1 (own signal/job-control handling), use --as-pid-1 to skip bwrap's reaper.
6. Combine with --unshare-all for fuller isolation.
7. Reference (official docs): https://raw.githubusercontent.com/containers/bubblewrap/main/bwrap.xml